Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Logs not picking sourcetype from props.conf in...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
we want to parse the logs on HF before logs are forwarded to indexers. logs are forwarded from universal forwarder to heavy forwarder. I have given sourcetype in inputs.conf on UF and created props.conf with same sourcetype value stanza( extract = regex). logs are comeing with sourcetype i have given in inputs.conf but its not picking file in props.conf where the regex is. so logs are not parsed. i have tested props.conf and it parsed correctly on test environment but this by uploading file. Am i missing anything here ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.
On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.
On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! that worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you also placed the props.conf on the UF? If yes, remove the props.conf on the UF. Could you also paste the contents of the props.conf here?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you load the props.conf file on the HF and restart the HF?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes. i did.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
